Ransomware is malware that encrypts or locks computer files, and then demands payment of a “ransom” to decrypt or unlock them. There is no guarantee that paying the ransom will regain access and victims of ransomware can be subject to multiple attacks if they are not protected. Conventional techniques for detecting ransomware may involve monitoring the behavior of executing processes to detect when the processes behave in a way indicative of ransomware. However, these behavior-based detection methods are often unable to detect and stop the ransomware before it has successfully encrypted one or more files. As a result, some user files may become irrecoverably lost.